DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
TMethodImplementationIntercept
__dbk_fcall_wrapper
dbkFCallWrapperAddr
Behavioral task
behavioral1
Sample
94489bb20448f1afd2307139e06246b1_JaffaCakes118.dll
Resource
win7-20240708-en
Target
94489bb20448f1afd2307139e06246b1_JaffaCakes118
Size
1.0MB
MD5
94489bb20448f1afd2307139e06246b1
SHA1
557ee9cf46914b5716e55a3807e4bf6f0ee9416b
SHA256
f7cf97c7daeb95f2c5d9503774b3e1fd18faece4efeebec7d733134a1229f051
SHA512
1901c5869b619a7db9ebfcb7743f6010496d94e3847e7077d71931ceb5061d805d095b8a09766a03cd10a67da616016281f2f75d5b13c9dc4d689bbaeeed63c1
SSDEEP
24576:Co5r2HGKESukjA+YxGM6ifSKiecYZJacAlLK1XvoTVIg9izv:/QHGKESF72KezjAlLyXvoTig4zv
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
94489bb20448f1afd2307139e06246b1_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
TMethodImplementationIntercept
__dbk_fcall_wrapper
dbkFCallWrapperAddr
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE